[rudycelekli]

Bug

POST /api/v1/servers/{id}/config-to-secret refuses to convert a value that is already a reference, but the check is strings.HasPrefix(value, "${keyring:") || strings.HasPrefix(value, "${env:"). Two kinds of values get past it:

• a ${file:/path} reference (the provider added in feat(secret): ${file:/absolute/path} references (Spec 111 FR-030) #1717);
• a composite value with an embedded reference, such as the documented "Authorization": "Bearer ${keyring:github-token}" (docs/features/keyring-integration.md).

For these values the handler stores the literal text in the keyring and rewrites the field to ${keyring:<secret_name>}. Secret expansion runs once, so on the next connect the upstream gets the unresolved text, for example Bearer ${keyring:github-token} or ${file:/run/secrets/github-token}, as its credential.

The API masks both values on the read path because IsConfigReference only passes through an exact ${keyring:..} or ${env:..} value. The UI therefore shows them as plain secrets and offers Convert-to-secret.

Trigger

"headers": {"Authorization": "Bearer ${keyring:github-token}"}

POST /api/v1/servers/<name>/config-to-secret with {"scope":"header","key":"Authorization","secret_name":"gh2"} succeeds. After that, the header sent upstream is the literal Bearer ${keyring:github-token}.

Fix

Use secret.IsSecretRef(value), which matches any ${type:name} reference anywhere in the value. The handler then returns the existing 400 "already a reference" error for these values.

Test

Two cases added to TestHandleConvertConfigToSecret_ValidationErrors: an env value ${file:/run/secrets/github-token} and a header Bearer ${keyring:github-token}. Both must be rejected with 400 before the resolver is called.

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/httpapi: ok
• With server.go reverted, both new cases fail (expected: 400, actual: 500). The handler gets past validation and reaches the resolver, which the mock leaves nil.
• go vet ./internal/httpapi, gofmt -l internal/httpapi/: clean

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!